Engineering Trust: Integrating Security into Your Modern SDLC
summary
Claims that ISO 27001 maps onto a modern SDLC by enforcing concrete controls: ISO 27001 clause A.8 becomes threat modeling with STRIDE, secure coding checklists, and mandatory peer review. Tools actually used include Google ErrorProne, Sonar + an MCP server, dependency scanners like Snyk, Docker/image scans, TF lint, pre-commit hooks and runtime tests via ZAP/TestCube. The audit-driven program forces automation across CI/CD; an earlier breach that required patching 400 systems and a 600,000 cars exposed S3 leak motivate the work and the certification measurably improves security posture.
AI-written summary · about
chapters (14)
- 0:00Modern security introduction
- 1:14Our breach and lessons
- 2:47Cybercrime threat growth
- 4:45Small mistakes, big vulnerabilities
- 6:22Critical security failures examples
- 10:31Security in SDLC necessity
- 12:11ISO 27001 explained
- 16:03Secure SDLC practices
- 20:50STRIDE threat modeling
- 27:53Securing software architecture
- 34:12Secure coding basics
- 36:55Security in CI/CD automation
- 38:53Secure delivery pipeline
- 40:22Security maturity improvement
related talks
50mMapping ISO 27001 to Modern Software Engineering: Secure by Design
40mMaking Security an integrated part of the SW Dev Lifecycle
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
27mMulti Security Checkpoints on DevOps Platform
26mSimple Guide to Secure SDLC
42mContinuous Security: Integrate security tools into your DevOps Pipeline
29m3rd-Party Cyber-Risk Mitigation by Using ISO Standards
58mHow to embed security into your process